HYBRIS virus

Subject: RE: HYBRIS virus
From: Bernard
Date: 13 Mar 01 - 07:22 AM

It's a disgrace. If these morons would put their minds to something useful, they could well make a fortune.

Unfortunately, they prey on the misfortune of others.

Subject: RE: HYBRIS virus
From: GUEST,susan
Date: 13 Mar 01 - 07:14 AM

The last time I received the so called virus ( about 3 times to date) the last time it was just in my inbox. My husband has set up email folder for myself under my name and one under his name and one under something else and then we have the inbox for the ones that don't fit in the other folders. I opened my folder and read my email then clicked on the inbox icon and the anti virus program kicked in but too late it infected the email component of the computer.

It was sent from Hahaha!!! He/she has sent us pretty worm virus and the snow white and the seven dwarfs and Navidexe If he/she is out there if I ever meet you watch out. You have cost my husband and I a lot of money and precious time in fixing our computer.

Subject: RE: HYBRIS virus
From: Penny S.
Date: 12 Mar 01 - 04:59 PM

Bernard, I started to post yesterday, but ran out of juice - I know the distinction, but my address book and my inbox have roughly the same list in them, barring commercial sites which from their particular natures I would think to be safe. I have my suspicions of someone from a newsgroup who mailed me once. Everyone else seems untouched. Odd.

Penny

Subject: RE: HYBRIS virus
From: Bernard
Date: 10 Mar 01 - 08:02 PM

A virus is a program, which means it has to be 'run'.

There is nothing to fear from straight graphic files - self extracting archive files containing such graphics are, however, 'open to infection'.

Penny - you don't need to have the names in your address book to receive a virus - only to pass it on, which is how you and I got it.

Worm viruses can come from anyone who has your email address and a worm virus infected computer.

You cannot do much to prevent the virus arriving, but you can do lots to detect and eradicate it once it arrives.

Some ISP's claim to scan for viruses - Freeserve and Yahoo both make that claim. Oddly, the indication is that I received the virus from a Yahoo user, and I'm a Freeserve user...

It's sad, though, that there are people out there wih nothing better to do than to rob innocent people of their most precious gift - time.

Subject: RE: HYBRIS virus
From: gnu
Date: 10 Mar 01 - 02:15 PM

Can you catch anything from a jpg ? I often receive jokes, cartoons, funny photos, etc, from buddies and open jpg's w/o much fear. Should I ?

gnu

Subject: RE: HYBRIS virus
From: Penny S.
Date: 10 Mar 01 - 02:07 PM

Seem to have escaped safely - I've tested by mailing another persona so it wouldn't infect a different machine, to see if it turned up there, which it didn't. I do have a collection of clean boot floppies if not. But who, out of my small list of contacts, did it come from? Not McAfee, I should think.

Penny

Subject: RE: HYBRIS virus
From: Bernard
Date: 10 Mar 01 - 06:10 AM

Yes, Penny, sounds about right.

My understanding of worm virus types is you're okay as long as you don't open the attachment.

I 'quarantined' the offending message in a different folder, exported it to a file for later surgery, and deleted the folder.

Then I ran the 'fix' from Symantec to be sure there was no 'infection'.

The extensions which cause most prblems are:
.EXE and .COM (executable program files)
.SCR (a Screensaver, which is really just a program file)
.BAT (which is an MSDOS Batchfile)
.DLL (Dynamic Link Library - plug-ins for Windows executables)
.OVL (overlays for executable files)
.SYS (system files, either programs or text instruction lists)
.VXD (usually 'drivers' for printers, etc.)
.VBX (Visual Basic runtime extension file)
The above isn't an exhaustive list, and the descriptions are given as a guide.

If you think you may have been 'infected', you should switch off your machine (one time where normal shut-down can do more harm than good), and re-boot from a CLEAN, bootable, write-protected floppy created when you installed your virus scanning software.

If you haven't got such a floppy, DO NOT MAKE ONE ONE THE INFECTED COMPUTER, or it, too, will be infected - and probably will report that the computer is 'clean'...

Instead, create the floppy on a machine that is known to be clean.

Many machines these days are configure to boot from a floppy only when the hard disk (and CD-Rom in many cases) have failed to provide a boot record. If your machine boots from the hard drive even when a floppy is present, you will need to go into the CMOS BIOS setup (usually 'Del' during POST (Power On Self Test)), and change the configuration.

I won't attempt to tell you how to do it here, as you can potentially do more harm than good if you don't know how already. If in doubt, talk to someone who knows!!

Happy hunting!

Subject: RE: HYBRIS virus
From: John J
Date: 10 Mar 01 - 05:22 AM

Keep up the good work Bernard! JJ

Subject: RE: HYBRIS virus
From: Penny S.
Date: 10 Mar 01 - 05:08 AM

Bernard, would that be one which turned up as an empty line in my Outlook Express Inbox? I haven't had anything from McAfee about it. I dealt with one like that by copying the content of the adjacent messages, highlighting all three (so the dubious item was never viewed) and deleting them, then repeating the process in the deleted box. And scanning.

Penny

Subject: RE: HYBRIS virus
From: GUEST
Date: 10 Mar 01 - 01:13 AM

Never open an .EXE file from a source you don't trust. And a few other extentensions I don't remember now. .Com, .Bat . And what's the deadly Visual Basic one, VBS?

Subject: HYBRIS virus
From: Bernard
Date: 09 Mar 01 - 03:07 PM

I've just received (but intercepted) a variant of the HYBRIS virus - Hybris Virus at Symantec.

It came to me in an email with no subject or sender information, and an attachment GHHHBBGH.EXE of approx 22k in size.

It has been quarantined for dissection - heh, heh, heh!!

I've no idea from whence it came - so be warned!